CWE-284 · Improper Access Control (page 78)
Page 78 of 82 — CVEs classified under CWE-284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-3863 | High | 7.8 | 2016-09-11 | Multiple stack-based buffer overflows in the AVCC reassembly implementation in Utils.cpp in libstagefright in MediaMuxer in Android 4.x before 4.4.4, 5.0.x bef… |
CVE-2016-6179 | High | 7.0 | 2016-09-07 | The WiFi driver in Huawei Honor 6 smartphones with software H60-L01 before H60-L01C00B850, H60-L11 before H60-L11C00B850, H60-L21 before H60-L21C00B850, H60-L0… |
CVE-2016-5404 | Medium | 6.5 | 2016-09-07 | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certific… |
CVE-2016-7107 | High | 7.5 | 2016-09-07 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system… |
CVE-2016-6898 | Medium | 6.6 | 2016-09-07 | XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote… |
CVE-2016-6317 | High | 7.5 | 2016-09-07 | Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JS… |
CVE-2016-6184 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6183 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6182 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6181 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6180 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-5022 | Critical | 9.8 | 2016-09-07 | F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x… |
CVE-2016-5383 | High | 8.8 | 2016-08-26 | The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters." |
CVE-2016-5023 | High | 7.5 | 2016-08-26 | Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configu… |
CVE-2016-5673 | High | 7.5 | 2016-08-25 | UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy functionality by usin… |
CVE-2016-5650 | High | 7.5 | 2016-08-24 | ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary acce… |
CVE-2016-5645 | High | 7.3 | 2016-08-24 | Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP commu… |
CVE-2016-5736 | High | 7.5 | 2016-08-19 | The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.1 before HF16, 11.4.x, 11.5.x before 1… |
CVE-2016-0760 | High | 8.8 | 2016-08-19 | Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2)… |
CVE-2016-3319 | High | 7.0 | 2016-08-09 | The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbi… |
CVE-2016-3299 | Medium | 5.3 | 2016-08-09 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Go… |
CVE-2016-2989 | Medium | 6.5 | 2016-08-08 | Open redirect vulnerability in the Connections Portlets component 5.x before 5.0.2 for IBM WebSphere Portal allows remote attackers to redirect users to arbitr… |
CVE-2016-2960 | Low | 3.7 | 2016-08-08 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix P… |
CVE-2016-1474 | Medium | 4.3 | 2016-08-08 | Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks… |
CVE-2015-3854 | High | 7.5 | 2016-08-07 | packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement… |
CVE-2016-5144 | Critical | 9.8 | 2016-08-07 | The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
CVE-2016-6198 | Medium | 5.5 | 2016-08-06 | The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows… |
CVE-2014-9865 | High | 7.8 | 2016-08-06 | drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not properly restrict user-space input, whi… |
CVE-2016-3839 | Medium | 5.5 | 2016-08-05 | Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of… |
CVE-2016-3838 | Medium | 5.5 | 2016-08-05 | Android 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of locked-screen 911 functionality) via a crafted application that uses the a… |
CVE-2014-9901 | High | 7.5 | 2016-08-05 | The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, which allows remote attackers to cause a denia… |
CVE-2016-6150 | Critical | 9.8 | 2016-08-05 | The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restr… |
CVE-2016-6144 | High | 8.1 | 2016-08-05 | The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not… |
CVE-2016-6140 | Critical | 9.8 | 2016-08-05 | SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203591. |
CVE-2016-6258 | High | 8.8 | 2016-08-02 | The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-pa… |
CVE-2016-5229 | Critical | 9.8 | 2016-08-02 | Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute… |
CVE-2016-4373 | Critical | 9.8 | 2016-08-01 | The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted seri… |
CVE-2016-1608 | High | 8.8 | 2016-08-01 | vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via… |
CVE-2016-3992 | Medium | 6.2 | 2016-07-26 | cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /… |
CVE-2016-5130 | Medium | 6.5 | 2016-07-23 | content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allo… |
CVE-2016-4591 | High | 7.5 | 2016-07-22 | WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the loca… |
CVE-2016-5388 | High | 8.1 | 2016-07-19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applica… |
CVE-2016-5386 | High | 8.1 | 2016-07-19 | The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications… |
CVE-2016-5661 | High | 8.8 | 2016-07-15 | Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitra… |
CVE-2016-0357 | Medium | 4.3 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows remote attackers to conduct clickjacking atta… |
CVE-2016-0340 | High | 7.4 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote a… |
CVE-2016-0339 | Medium | 5.6 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which m… |
CVE-2016-5807 | High | 8.1 | 2016-07-15 | Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or chan… |
CVE-2016-5109 | Medium | 4.3 | 2016-07-13 | Citrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Appl… |
CVE-2016-5008 | Critical | 9.8 | 2016-07-13 | libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass… |
CVE-2016-4215 | Critical | 9.8 | 2016-07-13 | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017… |
CVE-2016-3276 | Low | 3.1 | 2016-07-13 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing… |
CVE-2016-3274 | Low | 3.1 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browse… |
CVE-2016-3245 | Medium | 6.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "I… |
CVE-2016-3244 | Medium | 4.3 | 2016-07-13 | Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature Bypass." |
CVE-2016-3818 | Medium | 5.5 | 2016-07-11 | libc in Android 4.x before 4.4.4 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28740702. |
CVE-2014-9798 | Medium | 5.5 | 2016-07-11 | platform/msm_shared/dev_tree.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 devices does not check the relationship between tags addresse… |
CVE-2016-0315 | High | 8.8 | 2016-07-08 | The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain sessi… |
CVE-2016-4979 | High | 7.5 | 2016-07-06 | The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for H… |
CVE-2016-0906 | High | 8.8 | 2016-07-06 | The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authent… |
CVE-2016-0391 | Critical | 9.8 | 2016-07-02 | The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier fo… |
CVE-2015-8801 | Low | 2.9 | 2016-06-30 | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer… |
CVE-2016-0349 | Medium | 6.5 | 2016-06-30 | IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and… |
CVE-2016-5101 | High | 8.8 | 2016-06-29 | Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail messa… |
CVE-2016-1237 | Medium | 5.5 | 2016-06-29 | nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl… |
CVE-2016-0304 | High | 8.1 | 2016-06-29 | The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is… |
CVE-2016-3713 | High | 7.1 | 2016-06-27 | The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm… |
CVE-2016-3707 | High | 8.1 | 2016-06-27 | The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327… |
CVE-2016-0279 | High | 7.8 | 2016-06-26 | Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbi… |
CVE-2016-0278 | High | 7.8 | 2016-06-26 | Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbi… |
CVE-2016-0277 | High | 7.8 | 2016-06-26 | Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbi… |
CVE-2015-7473 | Low | 2.5 | 2016-06-26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +con… |
CVE-2016-1190 | Medium | 6.5 | 2016-06-25 | Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors. |
CVE-2016-0914 | Medium | 6.3 | 2016-06-23 | EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before P… |
CVE-2016-4811 | Medium | 5.6 | 2016-06-19 | The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attack… |
CVE-2016-0392 | High | 8.4 | 2016-06-19 | IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x be… |
CVE-2016-4813 | High | 8.8 | 2016-06-19 | NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account. |
CVE-2016-3226 | Medium | 6.5 | 2016-06-16 | Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service ha… |
CVE-2016-5366 | High | 7.5 | 2016-06-14 | Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to modify configuration data via vectors related to a "file injection vuln… |
CVE-2016-3698 | High | 8.1 | 2016-06-13 | libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attacker… |
CVE-2014-9773 | High | 7.5 | 2016-06-13 | modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the (1) LIST, (2) CLEAR… |
CVE-2016-5302 | Critical | 9.8 | 2016-06-13 | Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management networ… |
CVE-2016-5104 | Medium | 5.3 | 2016-06-13 | The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate… |
CVE-2016-4911 | Medium | 4.3 | 2016-06-13 | The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of to… |
CVE-2016-1543 | High | 7.5 | 2016-06-13 | The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypa… |
CVE-2016-2831 | High | 8.8 | 2016-06-13 | Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote… |
CVE-2016-2829 | Medium | 6.5 | 2016-06-13 | Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permission requests, as demo… |
CVE-2016-2825 | Medium | 6.5 | 2016-06-13 | Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL. |
CVE-2016-2822 | Medium | 6.5 | 2016-06-13 | Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu. |
CVE-2016-2785 | Critical | 9.8 | 2016-06-10 | Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended au… |
CVE-2016-4524 | Medium | 6.5 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to obtain sensitive info… |
CVE-2016-4495 | Medium | 5.3 | 2016-06-10 | KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allow remote attackers to bypass intended access restrictions and read a configuration file via un… |
CVE-2016-2150 | High | 7.1 | 2016-06-09 | SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-… |
CVE-2016-1581 | Medium | 5.5 | 2016-06-09 | LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data… |
CVE-2016-3708 | High | 7.1 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespa… |
CVE-2016-3703 | Medium | 5.3 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API… |
CVE-2016-4369 | High | 8.8 | 2016-06-08 | HPE Discovery and Dependency Mapping Inventory (DDMi) 9.30, 9.31, 9.32, 9.32 update 1, 9.32 update 2, and 9.32 update 3 allows remote authenticated users to ex… |
CVE-2016-4963 | Medium | 4.7 | 2016-06-07 | The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confu… |
CVE-2014-8177 | Medium | 6.5 | 2016-06-07 | The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users to bypass the max_me… |
CVE-2016-1699 | Medium | 6.5 | 2016-06-05 | WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not e… |